I'm doing a wso2 migration from version 2.6.0 to 4.1.0. In version 2.6.0, we have our own com.carus.api.gateway.JwtTokenGenerator class that extends JWTGenerator, in our version certain claims are added there. I don't see a drastic difference in the generator except to update the versions of the dependencies to the latest ones, so I think the current generator should work in the same way on version 4.1.0
I do everything as it says in the documentation here: https://apim.docs.wso2.com/en/latest/deploy-and-publish/deploy-on-gateway/api-gateway/passing-enduser-attributes-to-the-backend-via-api-gateway/#expiry-time-of-the-jwt
I copy the same jar that works on 2.6.0 and extends JWTGenerator to wso2am-4.1.0/repository/components/lib
I start wso2 and make a request on devportal. In the logs, on another machine to which the request and this token are sent, I receive a token and there it appears that the request did not go through my generator. It looks like this:
{
"sub": "APIUSER",
"https://carus.com/claims/enduserTenantId": "-1234",
"https://carus.com/claims/subscriber": "CARCYAYU/apiuser",
"iss": "wso2.org/products/am",
"https://carus.com/claims/apiname": "Bookings Read API",
"https://carus.com/claims/tier": "Unlimited",
"https://carus.com/claims/applicationtier": "Unlimited",
"https://carus.com/claims/version": "v1",
"https://carus.com/claims/enduser": "CARCYAYU/apiuser@carbon.super",
"azp": "sQbDNZgidubfCGlb33IcGiQMJE8a",
"scope": "default",
"https://carus.com/claims/applicationUUId": "ce6354a5-0227-4ca2-b649-e959323dc9bc",
"https://carus.com/claims/apicontext": "/bookings-read/carcyayu/v1",
"https://carus.com/claims/applicationid": "3",
"exp": 1663422523,
"https://carus.com/claims/applicationname": "Yaroslav",
"https://carus.com/claims/keytype": "PRODUCTION",
"iat": 1663421623,
"jti": "42d5a74d-bb07-4608-9a7a-e3723ec834dd",
"https://carus.com/claims/usertype": "Application_User"
}
My config in deployment.toml:
[apim.jwt]
enable = true
encoding = "base64" # base64,base64url
generator_impl ="com.carus.api.gateway.JwtTokenGenerator"
claim_dialect ="https://carus.com/claims"
convert_dialect = true
header ="X-JWT-Assertion"
signing_algorithm = "NONE"
enable_user_claims = true
claims_extractor_impl = "org.wso2.carbon.apimgt.impl.token.DefaultClaimsRetriever"
Can someone explain to me how to make my generator work in this 4.1.0 version as well and how to include logs, where and what config to set so that my generator logs and in which file to look for them?
Also, the question is what is the difference between JWTGenerator and APIMgtGatewayJWTGeneratorImpl in version 2.6.0 was only JWTGenerator, this can be seen in the api-manager.xml file by versions.
The latest update is when I copy my custom generator (jar) to /components/lib. When I make a request, I receive the same token as above, but in the log file wso2carbon.log I get the following errors:
TID: [-1234] [oauth2] [2022-09-17 22:08:59,608] ERROR {org.wso2.is.notification.EventSender} - Error while sending Revocation Event to https://api-yayu-carc.internal.carus.com:9443/internal/data/v1/notify javax.net.ssl.SSLPeerUnverifiedException: Certificate for <api-yayu-carc.internal.carus.com> doesn't match any of the subject alternative names: [localhost]
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.verifyHostname(SSLConnectionSocketFactory.java:507)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:437)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.wso2.is.notification.EventSender$EventRunner.run(EventSender.java:116)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
TID: [-1234] [oauth2] [2022-09-17 22:09:10,256] ERROR {org.wso2.is.notification.EventSender} - Error while sending Revocation Event to https://api-yayu-carc.internal.carus.com:9443/internal/data/v1/notify javax.net.ssl.SSLPeerUnverifiedException: Certificate for <api-yayu-carc.internal.carus.com> doesn't match any of the subject alternative names: [localhost]
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.verifyHostname(SSLConnectionSocketFactory.java:507)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:437)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.wso2.is.notification.EventSender$EventRunner.run(EventSender.java:116)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
TID: [-1234] [] [2022-09-17 22:09:16,160] ERROR {org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl} - Error while parsing JWT org.apache.http.client.ClientProtocolException: URI does not specify a valid host name: https:9443/oauth2/jwks
at org.apache.http.impl.client.CloseableHttpClient.determineTarget(CloseableHttpClient.java:95)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.wso2.carbon.apimgt.impl.utils.JWTUtil.retrieveJWKSConfiguration_aroundBody0(JWTUtil.java:58)
at org.wso2.carbon.apimgt.impl.utils.JWTUtil.retrieveJWKSConfiguration(JWTUtil.java:52)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.retrieveJWKSet_aroundBody22(JWTValidatorImpl.java:227)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.retrieveJWKSet(JWTValidatorImpl.java:224)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateSignature_aroundBody8(JWTValidatorImpl.java:145)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateSignature(JWTValidatorImpl.java:135)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateToken_aroundBody0(JWTValidatorImpl.java:62)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateToken(JWTValidatorImpl.java:57)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidationServiceImpl.validateJWTToken_aroundBody0(JWTValidationServiceImpl.java:44)
at org.wso2.carbon.apimgt.impl.jwt.JWTValidationServiceImpl.validateJWTToken(JWTValidationServiceImpl.java:36)
at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.getJwtValidationInfo_aroundBody32(JWTValidator.java:691)
at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.getJwtValidationInfo(JWTValidator.java:659)
at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.authenticate_aroundBody0(JWTValidator.java:174)
at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.authenticate(JWTValidator.java:142)
at org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator.authenticate_aroundBody4(OAuthAuthenticator.java:301)
at org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator.authenticate(OAuthAuthenticator.java:111)
at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate_aroundBody56(APIAuthenticationHandler.java:522)
at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate(APIAuthenticationHandler.java:516)
at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest_aroundBody46(APIAuthenticationHandler.java:402)
at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest(APIAuthenticationHandler.java:353)
at org.apache.synapse.api.API.process(API.java:403)
at org.apache.synapse.api.AbstractApiHandler.apiProcessNonDefaultStrategy(AbstractApiHandler.java:107)
at org.apache.synapse.api.AbstractApiHandler.identifyAPI(AbstractApiHandler.java:127)
at org.apache.synapse.api.AbstractApiHandler.dispatchToAPI(AbstractApiHandler.java:59)
at org.apache.synapse.api.rest.RestRequestHandler.dispatchToAPI(RestRequestHandler.java:90)
at org.apache.synapse.api.rest.RestRequestHandler.process(RestRequestHandler.java:76)
at org.apache.synapse.rest.RESTRequestHandler.process(RESTRequestHandler.java:54)
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:344)
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101)
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180)
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376)
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:190)
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)